Something I just discovered the hard way so posting in case others hit the same behaviour:
When manually creating or migrating a bunch of user accounts (which I did from Joomla), the underlying filenames in user/accounts directory must all be lower case. Otherwise the login plugin will not find those users. The login IDs themselves are case-insensitive so whether the user logs in with JoeBlogs or joeblogs, the account filename must be joeblogs.yaml for the user to log in.
Probably not completely ideal behaviour.